DE
Contact us

For manufacturers on Finance, Supply Chain Management or Business Central

The Dynamics 365 MCP server exists. The security role behind it is the project.

Microsoft ships a Dynamics 365 MCP server for Finance and Supply Chain Management, and a Business Central server in public preview since October 2025; Claude can use both. Pexon does not rebuild them. We design the security role each agent runs under, the named action tools it may call and the per-call credit budget.

Four ways to put an agent on Dynamics 365

Each of these works. Here is the question to ask each one.

Dynamics 365 is the one ERP in our catalogue where the vendor already ships a documented MCP server on live data. The choice is not whether to build a server; it is which client runs the agent and who decides what that agent may touch.

  • Copilot Studio on Microsoft's server

    Orchestration and tool calls are billed at one fixed rate per agent action, and employee use is included for people licensed for Microsoft 365 Copilot.

    Does the agent ever need data from a system Microsoft does not host, such as your PLM or MES?

  • Claude on Microsoft's server, as shipped

    No server to build or run: add the client to Allowed MCP Clients and the agent sees data, form and action tools the same day.

    Which security role does the agent run under, and who signed off that role's reach?

  • Business Central MCP server

    Read-only by default and running as the signed-in user, a safer default than most vendor servers in our catalogue, several of which ship with write tools enabled.

    Can you live with a public preview that has no announced GA date?

  • Microsoft's server, restricted and extended by us

    A role cut to the task, named action tools for the operations that matter, and a credit budget per agent, on top of the server Microsoft maintains.

    Is the agent's work worth two weeks of role and tool design before it goes live?

Checked 19 September 2026

The two Microsoft servers are not the same product

AspectFinance and Supply Chain ManagementBusiness Central
StatusDynamic Dynamics 365 ERP MCP server; the static 13-tool server retires on 1 October 2026Public preview since 31 October 2025, no GA date in the release plan
What the agent getsData tools (CRUD on entities), form tools (drive forms like a user), action tools (classes that implement ICustomAPI)Tools generated from exposed API pages; anything not on an API page needs a custom AL API page
Default rightsWhatever the agent's security role allows, including create, update and deleteRead-only; create, modify, delete and bound actions are enabled per API page
IdentityMicrosoft Entra ID; the client must be on the Allowed MCP Clients pageOAuth 2.0 authorisation code with PKCE via Entra ID, acting as the user
Billing for Claude and other non-Microsoft clients0.1 Copilot Credits per tool call; waived for Finance Premium and SCM Premium usersNot stated on Microsoft's MCP overview page

Minimum for Finance and SCM: version 10.0.47, 10.0.46 PQU-2 or 10.0.45 PQU-7, on Tier 2 or above or a Unified Developer Environment. Cloud Hosted Environments are not supported.

Microsoft decided what the server can do. You decide what the agent may do, and that decision is a security role nobody has designed yet.

Where Dynamics 365 is hard for agents

What the documentation leaves to you

Microsoft is explicit that the agent's security role determines which forms, entities and actions it sees. That puts the real work on your side of the line.

  • The role is the scope. A dynamic server exposes nearly every function a user could reach. An agent under an existing human role inherits years of accumulated privileges; the agent needs a role built for its one task.
  • Form tools are chatty. Microsoft's own documentation says data tools need fewer tool calls than form tools for standard operations. Every extra call is billed by Microsoft and read by the model, so agent instructions have to steer it to data tools.
  • The 1 October deadline. Anything built on the static 13-tool server stops when it retires. Its fixed tools do not map one to one onto the dynamic data, form and action tools.
  • Known limits. US English metadata only, ISO dates regardless of locale, no advanced grid filters, no calendar or custom controls, no security or user administration forms, and no service during servicing windows.
  • Licensing edges. The agent identity needs no licence with the System agent role; the people chatting with it do. For Business Central, per-call billing for non-Microsoft clients is not stated, so check it with Microsoft or your partner before volume.

Read from Microsoft Learn on 19 September 2026: the Finance and Operations MCP article dated 18 August 2026 and the Business Central MCP overview. Microsoft updates both frequently; re-check before a go-live date.

What we build

Three pieces on top of Microsoft's server

01

A security role per agent, designed for its task

We start from the task, not from an existing role: which menu items, entities and actions the agent needs, and nothing it does not. Duties and privileges are assembled for that list, the agent identity gets the System agent role for licensing plus this one, and the result is tested by asking the agent for something just outside its scope.

Test: a request one privilege outside the role must be refused, not answered from a form the role can reach by accident.

02

Named action tools for the operations that matter

Where an operation is business logic rather than a record, we write it as a class implementing ICustomAPI, so the agent calls one named action instead of clicking through five forms. A first set for manufacturing: explain_production_order_delay, list_shortages_for_order, get_open_requisitions_for_buyer, draft_vendor_confirmation_update and summarise_unreconciled_items. Drafts are proposals a person saves; nothing posts.

Why: one action call replaces a sequence of form calls, which is cheaper on both the Microsoft and the token side.

03

A credit budget and an audit trail per agent

We set a monthly credit expectation per agent from its tool list and expected volume, instructions that keep it on data tools, and a log that joins Microsoft's tool calls to the person who asked. For agents that combine Dynamics 365 with a system Microsoft does not host, the same identity and audit pattern carries into that system's server.

Start with the Readiness Blueprint.

Two weeks, €4,900 fixed price. We pick one agent task, design its security role, write down the action tools it needs, estimate its monthly tool calls and check whether the static server is anywhere in your estate. All prices are net and exclude VAT.

What we need from you: a Tier 2 environment we may use, a Dynamics 365 security administrator, and the owner of the business process the agent will touch. After the blueprint, a use-case pilot builds the role, the action classes and the guardrails, and your team or ours runs them.

Sources: Microsoft Learn: Use Model Context Protocol for finance and operations apps · Microsoft Learn: Business Central MCP server overview · Business Central release plan: connect AI agents through MCP · Copilot Studio billing rates. Read 19 September 2026. Vendor documentation changes; verify against the current release.

Related

Questions about Dynamics 365 and MCP

Can Claude connect to the Dynamics 365 MCP server?

Yes, to both servers. For Finance and Supply Chain Management, an administrator adds the client on the Allowed MCP Clients page, and the environment must run version 10.0.47 or later on Tier 2 or above. Business Central names Claude as a compatible client; non-Microsoft clients need their own app registration in Microsoft Entra ID.

What changes on 1 October 2026?

The static Dynamics 365 ERP MCP server is retired that day. It is the earlier server with 13 fixed business tools, built on the Dataverse connector framework. Agents built on it stop working unless they move to the dynamic server, whose generic data, form and action tools behave differently from the 13 fixed ones, so the agent's instructions and tests have to be reworked.

What does a Dynamics 365 MCP agent cost?

Three bills. Microsoft charges 0.1 Copilot Credits per tool call for clients other than Copilot Studio, waived for Finance Premium and Supply Chain Management Premium users. The model provider bills tokens. Our two-week Readiness Blueprint is fixed at €4,900, and a first production agent is usually a use-case pilot from €15,000. All our prices are net and exclude VAT.

Does the agent need its own Dynamics 365 licence?

Not for Finance and Operations, as of Microsoft's documentation in September 2026. An agent identity assigned the System agent security role is exempt from user licence requirements; that role grants no permissions, so the agent also needs a role that grants exactly what its tasks require. People who chat with the agent still need their own Dynamics 365 licence.

What can the Dynamics 365 MCP server not do today?

Several things a buyer should know before a pilot. It supports US English metadata only, no advanced grid filters such as date ranges, no calendar or custom controls, and it excludes security and user administration forms. It is unavailable during servicing windows. Business Central's server is still a preview with no announced GA date. And we have not run either server at a customer yet.

Next step

Not a sales call. An architecture call.

Thirty minutes with the architect who would run the engagement. Bring the name of the security role you would give an agent today.

Contact us